venus::iptables-restore < /etc/iptables.drop
moon::iptables-restore < /etc/iptables.drop
sun::iptables-restore < /etc/iptables.drop
venus::ip6tables-restore < /etc/ip6tables.rules
moon::ip6tables-restore < /etc/ip6tables.rules
sun::ip6tables-restore < /etc/ip6tables.rules
venus::systemctl start --no-block strongswan
moon::systemctl start --no-block strongswan
sun::systemctl start --no-block strongswan
alice::"ip route add fec2:\:/16 via fec1:\:1"
venus::"ip route add fec2:\:/16 via fec1:\:1"
moon::"ip route add fec2:\:/16 via fec0:\:2"
sun::"ip route add fec1:\:/16 via fec0:\:1"
bob::"ip route add fec1:\:/16 via fec2:\:1"
venus::"ip route add fec0:\:/16 via fec1:\:1"
winnetou::"ip route add fec1:\:/16 via fec0:\:1"
# add a route for part of the private subnet via bob
sun::"ip route add fec2:\:20/126 via fec2:\:10"
# force a lower MTU for traffic to bob
sun::"ip route add fec2:\:10/128 dev eth1 src fec2:\:1 mtu 1280"
# allow decrypted ICMPv6s from any source IP (rules for sun and moon are in ip6tables.rules)
venus::ip6tables -A INPUT -p icmpv6 -m policy --dir in -j ACCEPT
venus::expect-connection rw
moon::expect-connection net-net
sun::expect-connection net-net
moon::swanctl --initiate --child net-net
venus::swanctl --initiate --child rw